CVE-2026-53905 | MCO does not properly enforce authorization checks in the /c… | CVSS 5.3 MEDIUM

Description

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint. An authenticated, low-privileged user can retrieve administrator access control structures without proper authorization checks. This may expose sensitive permission mappings and internal configuration details. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 25.3.3.1 but may also affect other versions.

Metadata

CVE ID: CVE-2026-53905
State: PUBLISHED
Assigner: CERT-PL
Reserved: 2026-06-11 07:44 UTC
Published: 2026-07-01 11:58 UTC
Last updated: 2026-07-01 13:40 UTC
Primary CWE: CWE-863
CWE-863 Incorrect Authorization
Vendor / Product: MyComplianceOffice / MCO
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
MyComplianceOffice	MCO	—	25.3.3.1

Weakness (CWE)

CWE	Source	Description
CWE-863	cna	CWE-863 Incorrect Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References (2)